CVE-2021-40180

In the WeChat application 8.0.10 for Android and iOS, a mini program can obtain sensitive information from a user's address book via wx.searchContacts.

• CWE-200

• https://arxiv.org/pdf/2205.15202.pdfMitigation, Technical Description, Third Party Advisory
• https://github.com/BESTICSP/Vulnerabilities-Related-to-Mini-Programs-Permissions/blob/main/WX%20applet%20contact%20permission%20vulnerability%20report.pdfExploit, Third Party Advisory
• https://pan.baidu.com/s/116sAQvs1CEzCeIfpI1NZvAExploit, Permissions Required, Third Party Advisory
• https://pan.baidu.com/s/1RqMrZBruZZ4OHdnXUN5xDwExploit, Permissions Required, Third Party Advisory
• https://arxiv.org/pdf/2205.15202.pdfMitigation, Technical Description, Third Party Advisory
• https://github.com/BESTICSP/Vulnerabilities-Related-to-Mini-Programs-Permissions/blob/main/WX%20applet%20contact%20permission%20vulnerability%20report.pdfExploit, Third Party Advisory
• https://pan.baidu.com/s/116sAQvs1CEzCeIfpI1NZvAExploit, Permissions Required, Third Party Advisory
• https://pan.baidu.com/s/1RqMrZBruZZ4OHdnXUN5xDwExploit, Permissions Required, Third Party Advisory

Published

Jul 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40174Zoho ManageEngine Log360 before Build 5224 allows a CSRF att…8.8
• CVE-2021-40175Zoho ManageEngine Log360 before Build 5219 allows unrestrict…9.8
• CVE-2021-40176Zoho ManageEngine Log360 before Build 5225 allows stored XSS…6.1
• CVE-2021-40177Zoho ManageEngine Log360 before Build 5225 allows remote cod…9.8
• CVE-2021-40178Zoho ManageEngine Log360 before Build 5224 allows stored XSS…6.1
• CVE-2021-4018snipe-it is vulnerable to Improper Neutralization of Input D…5.4
• CVE-2021-40186The AppCheck research team identified a Server-Side Request …7.5
• CVE-2021-40188PHPFusion 9.03.110 is affected by an arbitrary file upload v…7.2
• CVE-2021-40189PHPFusion 9.03.110 is affected by a remote code execution vu…7.2
• CVE-2021-4019vim is vulnerable to Heap-based Buffer Overflow7.8
• CVE-2021-40191Dzzoffice Version 2.02.1 is affected by cross-site scripting…5.4
• CVE-2021-4020janus-gateway is vulnerable to Improper Neutralization of In…5.4